Installation Script is sensitive to bash syntax characters in password

[ForestJohnson]

Describe the bug

My friend was trying to set up mattermost on yunohost and they encountered an issue where the bash install script interpreted a character that they typed into their password as syntax. They were eventually identify the problematic character as ( but I know there are probably mulitple ways this can go bad in bash.

mattermost_ynh/scripts/install

Line 31 in 19024d2

password=$YNH_APP_ARG_PASSWORD

...

mattermost_ynh/scripts/install

Line 173 in 19024d2

ynh_exec_warn_less ynh_exec_as $app bin/mattermost user create --username "$admin" --email "$email" --password "$password" --locale "$language" --system_admin

Context

• Hardware: Raspberry Pi3 at home
• YunoHost version: V 4.2.8.3
• I have access to my server: Through SSH, through the webadmin, and direct access via keyboard
• Are you in a special context or did you perform some particular tweaking on your YunoHost instance?: yes
  • If yes, please explain: "No tweaking that I recall, although special context is using a .local domain"
• Using, or trying to install package version/branch: YunoHost-Apps/mattermost_ynh 5.39.0-ynh1

Steps to reproduce

Install mattermost for yunohost
enter the password (i_like_eggs

Expected behavior

It works 😇

Logs

They posted this log in chat channel:

2021-10-13 18:01:51,044: DEBUG - /var/www/mattermost /var/cache/yunohost/app_tmp_work_dirs/app_j2vv0kq9/scripts 

2021-10-13 18:01:51,046: DEBUG - + ynh_exec_warn_less ynh_exec_as mattermost bin/mattermost user create --username yunoadminator --email [email protected] --password '**********' --locale en --system_admin 

2021-10-13 18:01:51,048: DEBUG - + eval ynh_exec_as mattermost bin/mattermost user create --username yunoadminator --email [email protected] --password '**********' --locale en --system_admin 

2021-10-13 18:01:51,050: DEBUG - /usr/share/yunohost/helpers.d/logging: eval: line 142: syntax error near unexpected token`('

[ForestJohnson]

I'm pretty sure that shellcheck catches these kinds of errors;

https://www.shellcheck.net/

here's an example:

 
Line 30:
email=$(ynh_user_get_info --username=$admin --key=mail)
                                     ^-- SC2086 (info): Double quote to prevent globbing and word splitting.

https://github.com/koalaman/shellcheck/wiki/SC2086

[keomabrun]

yop, same here, got the same error when using a password that contained a " symbol.